Nhận dạng:
Tự động gửi link khi chát chít, dạng (lưu ý không nên click vào link virus bên dưới):
foto http://facebook-lmg.com/image.php
foto http://msn-lmages.com/image.php
foto http://miggiphotos.com/image.php
foto http://funwiththisguy.com/image.php
foto http://ariafotos.com/image.php
foto http://zhelefun.com/image.php
foto http://tviceimg.com/image.php
foto http://tusfbfotos.com/image.php
foto http://twittersphoto.com/image.php
foto http://tuesimages.com/image.php
foto http://red-myspace.com/image.php
Đầu tiên bạn xóa các file sau:
C:\Windows\mds.sys
C:\Windows\mdt.sys
C:\Windows\winbrd.jpg
C:\Windows\net.exe
C:\Windows\infocard.exe
Sau đó bạn xóa các key sau:
Vào Run(Win + R) gõ regedit rồi Enter
[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run]
“Firewall Administrating”=”C:\\WINDOWS\\infocard.exe” “Administrating Firewall” = “C:\WINDOWS\\ infocard.exe”
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
“Firewall Administrating”=”C:\\WINDOWS\\infocard.exe” “Administrating Firewall” = “C:\WINDOWS\\ infocard.exe”
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentV ersion\Run] “Administrating Firewall” = “C:\WINDOWS\\ infocard.exe”
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\S haredAccess\Parameters\FirewallPolicy\StandardProf ile\AuthorizedApplications\List]
“C:\\Documents and Settings\\\\Desktop\\IM56245.JPG-www.myspace.com.exe”=”C:\\WINDOWS\\infocard.ex e:*:Enabled:Firewall Administrating” “C:\Documents and Settings\\ [b] [/ b]\\ Desktop\\ IM56245.JPG-www.myspace.com.exe” = “C:\WINDOWS\\ infocard.exe: *: Enabled: Firewall Administrating ”
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPolicy\Standard Profile\AuthorizedApplications\List]
“C:\\Documents and Settings\\\\Desktop\\IM56245.JPG-www.myspace.com.exe”=”C:\\WINDOWS\\infocard.ex e:*:Enabled:Firewall Administrating” “C:\Documents and Settings\\ [b] [/ b]\\ Desktop\\ IM56245.JPG-www.myspace.com.exe” = “C:\WINDOWS\\ infocard.exe: *: Enabled: Firewall Administrating ”
[HKEY_USERS\S-1-5-21-117609710-764733703-1957994488-1003\Software\Microsoft\Windows\CurrentVersion\Run]
“Firewall Administrating”=”C:\\WINDOWS\\infocard.exe” “Administrating Firewall” = “C:\WINDOWS\\ infocard.exe”
Hoặc vào: http://www.mediafire.com/?ggym4zjo3h5 tải trình diệt virus về quyét, tốt nhất thực hiện ở chế độ safemode